Privacy Policy COVID-19

Tests and management of measures

As of  10/31/2020 | Download as PDF

TCG UNITECH GmbH (hereinafter referred to as “TCG”) and the laboratory Dr. Georg Mößlacher/Innovetlab (hereinafter referred to as “Laboratory”) are each independent data controllers within the meaning of Art 4 (7) of the General Data Protection Regulation (“GDPR”) with regard to the processing of patient data in connection with the performance of COVID-19 PCR tests. TCG also independently performs tests related to COVID-19 (antibody, antigen), but no external data transfer is performed. This Privacy Policy serves to fulfill the requirements of Art 13 and 14 DSGVO in this context.

I. Who is responsible for data processing

Responsible is:
TCG UNITECH GmbH, Steiermärker Straße 49, 4560 Kirchdorf an der Krems, Austria

Laboratory / Data processor:
Dr. Georg Mößlacher, InnoVetLab
Laboratory ID: 124993

In the course of the SARS-CoV-2 pandemic according to the Epidemic Law §28(c)1 approved laboratory for the examination of human medical samples

II. What personal data are processed

TCG understands personal data to mean all information that relates to your person. As a sampling facility, the company doctor, outpatient clinic and porter areas also come into contact with so-called special categories of personal data. These are, in particular, health data, i.e. personal data relating to the physical health of a natural person, including the provision of health services, and from which information about his or her state of health is obtained (taking a temperature, taking samples).

In the course of performing COVID-19 testing, TCG processes a variety of categories of personal data about you, in particular your contact information and health data (such as saliva samples, blood samples; information about your health status). In principle, only those personal data are processed that are necessary for the fulfillment of the performance of COVID-19 tests.

III. For what purpose and on what legal basis does TCG process your personal data?

TCG processes your personal data mentioned under point II. in accordance with the provisions of the DSGVO for the purpose of conducting COVID-19 tests.

(Legal basis is Art 9 para 2 lit h DSGVO). In addition to the collection of your data through the test form, TCG performs the sample collection, in the case of PCR tests also the transmission of the samples to the laboratory and the billing.

The testing, collection, processing and disclosure of the data is carried out for the following purpose

  • Implementation of measures ordered by the authorities (e.g. quarantine of employees).
  • Prevention or containment of the spread of the CORONA virus (within the company or also by employees).

Consequently, there is also the processing of data necessary for the performance of the following tasks:

  • Collection of data on persons who have been diagnosed with an infection or who have been in contact with an infected person.
  • Collection of data on persons who have stayed in one of the risk areas during a relevant period.

To this end, data will also be collected from visitors/clients/external project staff, and generally from all persons in direct contact with staff, to determine whether they meet these two criteria (infected themselves and/or contact with infected persons; stay in a risk area).

IV. Legal basis

In the context of labor law, it should be noted that every employer has a duty of care towards its employees, which includes the exclusion of health risks in the workplace. Against this background, the processing of health data can be based on Art. 9(2)(b) of the GDPR in conjunction with the relevant provisions on the duty of care (processing for the purpose of fulfilling obligations under labor and social law). For the transfer of health data to the health authorities, Article 9 (2) (i) of the GDPR in conjunction with Section 10 (2) of the Data Protection Act provides a corresponding legal basis (processing for reasons of public interest in the area of public health). Furthermore, at the request of the district administrative authorities, the employer may also be obliged to provide information (on suspected cases and infections) pursuant to Article 9 (2) (i) of the GDPR in conjunction with Section 5 (3) of the Epidemic Act of 1950.

V. Where does your personal data come from?

For the COVID-19 test, TCG collects your data through the test form to be filled out or and performs the sample collection (e.g. handover of the spit test).

Other data is taken from visitor logs or also from contact diaries to be carried. Internal data comes from the TCG personnel administration and complies with the legal requirements.

VI. To whom does TCG transfer your personal data?

Laboratory in the course of performing COVID-19 PCR tests. InnoVetLab acts as the contract processor. In the case of TCG’s own tests, performed by authorized personnel, the data are processed internally.

Notifications in the case of a positive result are automatically made by the laboratory itself or TCG based on applicable laws. Whereas the laboratory with PCR tests, as a body authorized by the Ministry, provides a test result recognized by the authorities, and the internal tests have only informative character for the authorities.

In the case of positive PCR tests, TCG also transmits the social security number and contact details of employees to the laboratory in order to support the epidemiologically correct reporting of the laboratory to the authorities. (see legal basis).

VII. How long will your personal data be stored?

The personal data mentioned under point II. (in particular findings data) will be stored as long as it is necessary for the performance of the COVID-19 tests, as well as beyond that, if necessary, as provided by law.

In principle, data are stored as long as they are needed for the processing or proof of necessary measures. When the purpose ceases to exist, the data is deleted.

VIII. What data protection rights do you have?

You have the right to information under Art 15 GDPR, the right to rectification under Art 16 GDPR, the right to erasure under Art 17 GDPR, the right to restriction of processing under Art 18 GDPR, the right to object under Art 21 GDPR and the right to data portability under Art 20 GDPR. In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (Art 77 DSGVO).

For more information about your rights can be found here.

Please assert your data subject rights in connection with the performance and transport of swabs as well as with billing at

You can exercise your data subject rights in connection with laboratory services and the sending of findings at

The competent data protection authority for Austria is the “Datenschutzbehörde” (Data Protection Authority), Barichgasse 40-42, 1030 Vienna (